Actually, we don't think that the scammers broke into peoples' computers like this either. Photograph: Nick Rowe/Getty Images

Update: based on some of the comments here, it's clear that there have been purchases made very recently on the iTunes Store which have used people's login details - though apparently all linked to PayPal accounts. See the follow-on post for more on this - and what the scammers' motives might be. In the meantime, the opening of this article isn't supported by the facts we now know, so we'll strike it out.

Phishers have figured out a new way to transfer themselves loads of money and make it look legit: make it look like the charges are coming from the iTunes Store.

Problem is that they seem to have gotten greedy, which has made their greed surface. There's a scattering of reports that iTunes accounts have been hacked - hello TechCrunch, with "Fraudsters Drain PayPal Accounts Through iTunes", which says (a trifle breathlessly) that:

"Reports are appearing this morning about a major security hole in iTunes accounts linked to PayPal. At least one group of scammers has found a way to charge thousands of dollars to iTunes accounts through PayPal. One targeted customer told us, 'My account was charged over $4,700. I called security at PayPal and was told a large number of iTunes store accounts were compromised.'"

Look more closely, though, and it doesn't quite add up. Yes, people have seen their PayPal accounts drained of funds. Yes, they have received emails which say "Receipt for your payment to iTunes Store".

But that's where you have to look more closely. If you buy stuff on the iTunes Store via PayPal, the email subject line doesn't read like that. As Mark Derrick notes, it will read "Receipt for your payment to iTunes". Small difference, but significant.

Plus: the people who were scammed say that the receipt claims it was for the purchase (at $99.99 a time - clever one by the scammers, aiming to get it underneath the credit card "suspicion" level and also below the automatic level where the merchant has to bear the cost of reversing the payment) of "CastleCraft, Dragon Crystals (10000 Pack), Seller: Freeverse, Inc)".

Except that while the US store (the only one which allows payment via PayPal) does have CastleCraft (iTunes link), which does come from Freeverse, there's no product called "Dragon Crystals" and they don't come in 10,000 packs.

So - a non-existent product and an email subject line that wasn't generated by the iTunes Store. Conclusion: transaction not done via iTunes.

The conclusion: iTunes hasn't been cracked. PayPal has - or more precisely, some of its users have. This is almost certainly due to phishing where people have given up their passwords by being lured onto fake sites that have asked for their PayPal logins and passwords and got them. The crooks got greedy, which has meant that they got noticed; we can hope that PayPal, which goes to a lot of effort to track down organised scams like this, will put it all right.

Among those who fell victim was Dennis Rockstroh of the San Jose Mercury News; Apple told him that "Among other new security measures iTunes now requires more frequent re-entry of a customer's credit card security code. But if your credit card or iTunes password is stolen and used on iTunes, we recommend that you contact your financial institution and inquire about canceling the card and issuing a charge-back for any unauthorized transactions. We also recommend that you change your iTunes account password immediately." (What's odd about Rockstroh's account is that he says he contacted Apple, which reversed the transactions - however those were made against credit cards, not PayPal account

That goes of course for PayPal - though there's no obvious mechanism by which scammers could use your iTunes account to make payments to themselves to PayPal. (Is there?) Even so, the rule remains: be absolutely sure before you enter critical data such as your username and password onto any site.